@firebase/auth 0.22.0-canary.852ded64d → 0.22.0-canary.ea3849fff

package/dist/auth.d.ts

@@ -845,6 +845,7 @@ declare interface AuthInternal extends Auth {
     _logFramework(framework: string): void;
     _getFrameworks(): readonly string[];
     _getAdditionalHeaders(): Promise<Record<string, string>>;
+    _getAppCheckToken(): Promise<string | undefined>;
     readonly name: AppName;
     readonly config: ConfigInternal;
     languageCode: string | null;

package/dist/browser-cjs/{index-845ba5cf.js → index-a4932583.js}

@@ -423,6 +423,11 @@ const AUTH_ERROR_CODES_MAP_DO_NOT_USE_INTERNALLY = {
  * limitations under the License.
  */
 const logClient = new logger.Logger('@firebase/auth');
+function _logWarn(msg, ...args) {
+    if (logClient.logLevel <= logger.LogLevel.WARN) {
+        logClient.warn(`Auth (${app.SDK_VERSION}): ${msg}`, ...args);
+    }
+}
 function _logError(msg, ...args) {
     if (logClient.logLevel <= logger.LogLevel.ERROR) {
         logClient.error(`Auth (${app.SDK_VERSION}): ${msg}`, ...args);
@@ -2229,9 +2234,10 @@ class AuthMiddlewareQueue {
  * limitations under the License.
  */
 class AuthImpl {
-    constructor(app, heartbeatServiceProvider, config) {
+    constructor(app, heartbeatServiceProvider, appCheckServiceProvider, config) {
         this.app = app;
         this.heartbeatServiceProvider = heartbeatServiceProvider;
+        this.appCheckServiceProvider = appCheckServiceProvider;
         this.config = config;
         this.currentUser = null;
         this.emulatorConfig = null;
@@ -2647,8 +2653,26 @@ class AuthImpl {
         if (heartbeatsHeader) {
             headers["X-Firebase-Client" /* HttpHeader.X_FIREBASE_CLIENT */] = heartbeatsHeader;
         }
+        // If the App Check service exists, add the App Check token in the headers
+        const appCheckToken = await this._getAppCheckToken();
+        if (appCheckToken) {
+            headers["X-Firebase-AppCheck" /* HttpHeader.X_FIREBASE_APP_CHECK */] = appCheckToken;
+        }
         return headers;
     }
+    async _getAppCheckToken() {
+        var _a;
+        const appCheckTokenResult = await ((_a = this.appCheckServiceProvider
+            .getImmediate({ optional: true })) === null || _a === void 0 ? void 0 : _a.getToken());
+        if (appCheckTokenResult === null || appCheckTokenResult === void 0 ? void 0 : appCheckTokenResult.error) {
+            // Context: appCheck.getToken() will never throw even if an error happened.
+            // In the error case, a dummy token will be returned along with an error field describing
+            // the error. In general, we shouldn't care about the error condition and just use
+            // the token (actual or dummy) to send requests.
+            _logWarn(`Error while retrieving App Check token: ${appCheckTokenResult.error}`);
+        }
+        return appCheckTokenResult === null || appCheckTokenResult === void 0 ? void 0 : appCheckTokenResult.token;
+    }
 }
 /**
  * Method to be used to cast down to our private implmentation of Auth.
@@ -9114,7 +9138,13 @@ const WIDGET_PATH = '__/auth/handler';
  * @internal
  */
 const EMULATOR_WIDGET_PATH = 'emulator/auth/handler';
-function _getRedirectUrl(auth, provider, authType, redirectUrl, eventId, additionalParams) {
+/**
+ * Fragment name for the App Check token that gets passed to the widget
+ *
+ * @internal
+ */
+const FIREBASE_APP_CHECK_FRAGMENT_ID = encodeURIComponent('fac');
+async function _getRedirectUrl(auth, provider, authType, redirectUrl, eventId, additionalParams) {
     _assert(auth.config.authDomain, auth, "auth-domain-config-required" /* AuthErrorCode.MISSING_AUTH_DOMAIN */);
     _assert(auth.config.apiKey, auth, "invalid-api-key" /* AuthErrorCode.INVALID_API_KEY */);
     const params = {
@@ -9153,7 +9183,13 @@ function _getRedirectUrl(auth, provider, authType, redirectUrl, eventId, additio
             delete paramsDict[key];
         }
     }
-    return `${getHandlerBase(auth)}?${util.querystring(paramsDict).slice(1)}`;
+    // Sets the App Check token to pass to the widget
+    const appCheckToken = await auth._getAppCheckToken();
+    const appCheckTokenFragment = appCheckToken
+        ? `#${FIREBASE_APP_CHECK_FRAGMENT_ID}=${encodeURIComponent(appCheckToken)}`
+        : '';
+    // Start at index 1 to skip the leading '&' in the query string
+    return `${getHandlerBase(auth)}?${util.querystring(paramsDict).slice(1)}${appCheckTokenFragment}`;
 }
 function getHandlerBase({ config }) {
     if (!config.emulator) {
@@ -9197,12 +9233,13 @@ class BrowserPopupRedirectResolver {
     async _openPopup(auth, provider, authType, eventId) {
         var _a;
         debugAssert((_a = this.eventManagers[auth._key()]) === null || _a === void 0 ? void 0 : _a.manager, '_initialize() not called before _openPopup()');
-        const url = _getRedirectUrl(auth, provider, authType, _getCurrentUrl(), eventId);
+        const url = await _getRedirectUrl(auth, provider, authType, _getCurrentUrl(), eventId);
         return _open(auth, url, _generateEventId());
     }
     async _openRedirect(auth, provider, authType, eventId) {
         await this._originValidation(auth);
-        _setWindowLocation(_getRedirectUrl(auth, provider, authType, _getCurrentUrl(), eventId));
+        const url = await _getRedirectUrl(auth, provider, authType, _getCurrentUrl(), eventId);
+        _setWindowLocation(url);
         return new Promise(() => { });
     }
     _initialize(auth) {
@@ -9487,7 +9524,7 @@ function _isEmptyString(input) {
 }
 
 var name = "@firebase/auth";
-var version = "0.22.0-canary.852ded64d";
+var version = "0.22.0-canary.ea3849fff";
 
 /**
  * @license
@@ -9593,26 +9630,25 @@ function registerAuth(clientPlatform) {
     app._registerComponent(new component.Component("auth" /* _ComponentName.AUTH */, (container, { options: deps }) => {
         const app = container.getProvider('app').getImmediate();
         const heartbeatServiceProvider = container.getProvider('heartbeat');
+        const appCheckServiceProvider = container.getProvider('app-check-internal');
         const { apiKey, authDomain } = app.options;
-        return ((app, heartbeatServiceProvider) => {
-            _assert(apiKey && !apiKey.includes(':'), "invalid-api-key" /* AuthErrorCode.INVALID_API_KEY */, { appName: app.name });
-            // Auth domain is optional if IdP sign in isn't being used
-            _assert(!(authDomain === null || authDomain === void 0 ? void 0 : authDomain.includes(':')), "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */, {
-                appName: app.name
-            });
-            const config = {
-                apiKey,
-                authDomain,
-                clientPlatform,
-                apiHost: "identitytoolkit.googleapis.com" /* DefaultConfig.API_HOST */,
-                tokenApiHost: "securetoken.googleapis.com" /* DefaultConfig.TOKEN_API_HOST */,
-                apiScheme: "https" /* DefaultConfig.API_SCHEME */,
-                sdkClientVersion: _getClientVersion(clientPlatform)
-            };
-            const authInstance = new AuthImpl(app, heartbeatServiceProvider, config);
-            _initializeAuthInstance(authInstance, deps);
-            return authInstance;
-        })(app, heartbeatServiceProvider);
+        _assert(apiKey && !apiKey.includes(':'), "invalid-api-key" /* AuthErrorCode.INVALID_API_KEY */, { appName: app.name });
+        // Auth domain is optional if IdP sign in isn't being used
+        _assert(!(authDomain === null || authDomain === void 0 ? void 0 : authDomain.includes(':')), "argument-error" /* AuthErrorCode.ARGUMENT_ERROR */, {
+            appName: app.name
+        });
+        const config = {
+            apiKey,
+            authDomain,
+            clientPlatform,
+            apiHost: "identitytoolkit.googleapis.com" /* DefaultConfig.API_HOST */,
+            tokenApiHost: "securetoken.googleapis.com" /* DefaultConfig.TOKEN_API_HOST */,
+            apiScheme: "https" /* DefaultConfig.API_SCHEME */,
+            sdkClientVersion: _getClientVersion(clientPlatform)
+        };
+        const authInstance = new AuthImpl(app, heartbeatServiceProvider, appCheckServiceProvider, config);
+        _initializeAuthInstance(authInstance, deps);
+        return authInstance;
     }, "PUBLIC" /* ComponentType.PUBLIC */)
         /**
          * Auth can only be initialized by explicitly calling getAuth() or initializeAuth()
@@ -9816,4 +9852,4 @@ exports.updateProfile = updateProfile;
 exports.useDeviceLanguage = useDeviceLanguage;
 exports.verifyBeforeUpdateEmail = verifyBeforeUpdateEmail;
 exports.verifyPasswordResetCode = verifyPasswordResetCode;
-//# sourceMappingURL=index-845ba5cf.js.map
+//# sourceMappingURL=index-a4932583.js.map